System and method to protect privacy of personal-identification-number entry on consumer mobile device and computing apparatus
A system for accepting the input of a PIN comprises a first device receiving a randomized PIN layout derived on a fourth device. The randomized PIN layout is displayed on a display of the first device. A second device comprises an input for accepting a series of key presses to produce a PIN token. The PIN token indicating each of the series of key presses. A third device is in communication with the second device. The third device derives the randomized PIN layout and receives the PIN token from the second device without the PIN token being present on the first device. The third device combines the PIN layout and the PIN token to produce a PIN. The PIN is used to authenticate a transaction. The fourth and third devices each store a shared secret used to independently derive the randomized PIN layout on the fourth and third devices.
1. A method authenticating a device using secure personal identification number (PIN) entry, the method comprising:
determining, by a first device, a randomized PIN layout;
displaying, by the first device, the randomized PIN layout on a first display of the first device;
displaying, by a second device, a blank keypad that enables entry of key presses at locations of the blank keypad corresponding to the randomized PIN layout displayed by the first device;
in response to receipt of a series of key presses from a user on the blank keypad, generating, by the second device, a PIN token comprising data indicative of locations of each of the series of key presses;
transmitting, by the second device, the PIN token to a third device;
in response to receipt of the PIN token from the second device, producing, by the third device, values of a PIN based on a local copy of the randomized PIN layout generated by the third device and the locations of each of the key presses in the PIN token; and
authenticating the first device for performing a transaction with a remote services system based on the values of the PIN produced by the third device.
2. The method of claim 1 , wherein prior to the first device determining the randomized PIN layout, the method further comprises:
initializing a shared secret between the first device and the third device.
3. The method of claim 2 , wherein initializing the shared secret between the first device and the third device comprises:
exchanging the shared secret between the first device and the third device during a setup process performed on the first device.
4. The method of claim 2 , wherein initializing the shared secret between the first device and the third device comprises:
periodically exchanging a new shared secret between the first device and the third device.
5. The method of claim 2 , wherein the shared secret is a secret to derive a PIN layout corresponding to the randomized PIN layout displayed by the first device, and method further comprises:
determining, by the first device, the randomized PIN layout based on the shared secret;
generating, by the third device, the local copy of the randomized PIN layout based on the shared secret; and
wherein the randomized PIN layout is not transmitted between the first device and the third device.
6. The method of claim 2 , wherein the shared secret comprises a secret for encryption and decryption of data, and the method further comprises:
determining, by the first device, the randomized PIN layout;
encrypting, by the first device using the shared secret, the randomized PIN layout to generate encrypted data;
transmitting, by the first device, the encrypted data to the third device;
decrypting, by the third device using the shared secret, the encrypted data to generate the local copy of the randomized PIN layout; and
wherein an unencrypted version of the randomized PIN layout is not transmitted between the first device and the third device.
7. The method of claim 1 , wherein transmitting, by the second device, the PIN token to the third device, and producing, by the third device, the values of the PIN based on the local copy of the randomized PIN layout generated by the third device and the locations of each of the key presses in the PIN token, further comprises:
encrypting, by the second device prior to the transmitting, the PIN token to generate an encrypted copy of the PIN token;
transmitting, by the second device, the encrypted copy of the PIN token to the third device;
decrypting, by the third device, the encrypted copy of the PIN token to obtain an unencrypted copy of the PIN token; and
producing, by the third device, the values of the PIN based at least in part on the locations of each of the key presses in the unencrypted copy of the PIN token.
8. The method of claim 1 , wherein the third device is a server computer system remotely located from the second device, and the second device and the third device are communicatively coupled via a communications network.
9. The method of claim 1 , wherein the PIN token generated by the second device is not accessible to the first device, and the randomized PIN layout determined by the first device is not accessible to the second device.
10. The method of claim 1 , wherein the first device comprises a card reader device or a point of sale device.
11. A system for authenticating a device using secure personal identification number (PIN) entry, the system comprising:
a first device configured to: determine a randomized PIN layout, and display the randomized PIN layout on a first display of the first device;
a second device, communicatively coupled with the first device, configured to: display a blank keypad that enables entry of key presses at locations of the blank keypad corresponding to the randomized PIN layout displayed by the first device, in response to receipt of a series of key presses from a user on the blank keypad, generate a PIN token comprising data indicative of locations of each of the series of key presses, and transmit the PIN token to a third device;
the third device, communicatively coupled with the second device, configured to: in response to receipt of the PIN token from the second device, produce values of a PIN based on a local copy of the randomized PIN layout generated by the third device and the locations of each of the key presses in the PIN token, wherein the first device is authenticated for performing a transaction with a remote services system based on the values of the PIN produced by the third device.
12. The system of claim 11 , wherein prior to the first device determining the randomized PIN layout, a shared secret is initialized between the first device and the third device.
13. The system of claim 12 , wherein the shared secret is exchanged between the first device and the third device during a setup process performed on the first device.
14. The system of claim 12 , wherein a new shared secret is periodically exchanged between the first device and the third device.
15. The system of claim 12 , wherein the shared secret is a secret to derive a PIN layout corresponding to the randomized PIN layout displayed by the first device, and the system further comprises:
the first device configured to determine the randomized PIN layout based on the shared secret;
the third device configured to generate the local copy of the randomized PIN layout based on the shared secret; and
wherein the randomized PIN layout is not transmitted between the first device and the third device.
16. The system of claim 12 , wherein the shared secret comprises a secret for encryption and decryption of data, and the system further comprises:
the first device configured to: determine the randomized PIN layout, encrypt, using the shared secret, the randomized PIN layout to generate encrypted data, and the encrypted data to the third device;
the third device configured to decrypt, using the shared secret, the encrypted data to generate the local copy of the randomized PIN layout; and
wherein an unencrypted version of the randomized PIN layout is not transmitted between the first device and the third device.
17. The system of claim 11 , wherein the system further comprises:
the second device further configured to: encrypt, prior to the transmission of the PIN token to the third device, the PIN token to generate an encrypted copy of the PIN token, and transmit the encrypted copy of the PIN token to the third device; and
the third device further configured to: decrypt the encrypted copy of the PIN token to obtain an unencrypted copy of the PIN token, and produce the values of the user PIN based at least in part on the locations of each of the key presses in the unencrypted copy of the PIN token.
18. The system of claim 11 , wherein the third device is a server computer system remotely located from the second device, and the second device and the third device are communicatively coupled via a communications network.
19. The system of claim 11 , wherein the PIN token generated by the second device is not accessible to the first device, and the randomized PIN layout determined by the first device is not accessible to the second device.
20. The system of claim 11 , wherein the first device comprises a card reader device or a point of sale device.